fix(audit): break audit_log_path/_session_id deadlock

Pre-existing latent bug since d9e32e5: ``audit_log_path()`` acquires
the non-reentrant ``_LOCK`` and, while holding it, calls
``_session_id()`` which also takes ``_LOCK``. On a clean module state
(both ``_LOG_PATH`` and ``_SESSION_ID`` unset) the first caller
deadlocks.

``log_session_start`` triggers it in practice — it's the first GUI
call after import and the ``log_file=str(audit_log_path())`` arg is
evaluated before any ``log_event`` has had a chance to lazy-init the
session id. Strong candidate contributor to the blank-pages symptom
the kill switch was put back to mask: the writer thread (and any
producer reaching ``audit_log_path``) would freeze forever, and
Ctrl+C would not free the GIL — matches the launcher-can't-be-killed
behaviour reported in 1caedbb.

Fix: resolve the session id BEFORE acquiring ``_LOCK`` in
``audit_log_path``. ``_session_id`` already double-checks under its
own lock, so the call is safe and self-synchronising.

Test fixture in ``tests/test_audit.py`` now bypasses the kill switch
via ``monkeypatch.setattr(audit, "_DISABLED", False)`` — env vars are
captured at import time and ``monkeypatch.setenv`` won't reach the
module-level flag. With the fix in place, all 6 tests pass in 0.15s;
without it, ``test_session_start_renders`` (and any test exercising
the log_session_start path) hangs indefinitely.

Kill switch behaviour is unchanged in production (`_DISABLED = True`
in the shipped module); this is purely a correctness fix for the
code path that gets exercised when the switch is off.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/audit.py

@@ -121,13 +121,18 @@ def audit_log_path() -> Path:
     """
     global _LOG_PATH
     if _LOG_PATH is None:
+        # Resolve the session id BEFORE acquiring _LOCK. ``_session_id``
+        # also takes ``_LOCK`` to write its first value, and the lock
+        # is non-reentrant — nesting them deadlocks the first caller
+        # in a clean module state. (Hit in ``log_session_start`` since
+        # it's the first GUI call and both globals are unset.)
+        sid = _session_id()[:8]
         with _LOCK:
             if _LOG_PATH is None:
                 try:
                     ts = datetime.now(tz=timezone.utc).strftime("%Y%m%dT%H%M%SZ")
                 except Exception:
                     ts = "unknown"
-                sid = _session_id()[:8]
                 _LOG_PATH = audit_log_dir() / f"datatools-{ts}-{sid}.jsonl"
     return _LOG_PATH